CVE-2026-39387

CVE-2026-39387 is a critical Local File Inclusion vulnerability affecting BoidCMS versions prior to 2.1.3, an open-source PHP-based flat-file CMS. The vulnerability exists in the tpl (template) parameter, which is passed unsanitized to a require_once() statement without path validation, allowing authenticated administrators to inject path traversal sequences and include arbitrary files from the server. The vulnerability carries a CVSS 3.1 score of 7.2 (HIGH) with network-accessible attack vector, low complexity, and high privilege requirements. The primary concern is the chaining of this LFI with the application's file upload functionality to achieve Remote Code Execution; an attacker can upload malicious PHP code disguised as media files, then exploit the path traversal flaw to execute it with web server privileges, resulting in complete system compromise. Exploitation status indicates this vulnerability is currently inactive from a threat perspective. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, suggesting no evidence of active exploitation in the wild. The EPSS score of 0.0028 reflects exceptionally low predicted probability of exploitation, ranking this threat lower than 99.5 percent of all published CVEs. Community attention and exploit code availability appear minimal. Organizations running BoidCMS should prioritize updating to version 2.1.3 to remediate this risk, though the current threat level remains low.